Where it fits
Trace a framework control through a versioned evaluation to a risk decision that someone can explain.
The decision to make
Trace one framework control into a concrete evaluation rather than treating a framework map as assurance. Define the application boundary, selected test method and decision owner. A risk score can prioritize work, but the buyer still needs to know which source data and observed behaviors support it and what the test could not observe.
What this record does not establish
Atlas, evaluation, governance and security functions have distinct roles; the platform and managed service may have different scopes. No independent risk reduction, legal conformity or complete attack coverage is established.
1 current source · 4 published assertions
Source coverage is a research boundary, not a quality score.